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In this paper we set forth a novel connection between the Bennett 1992 protocol and a Bell inequal- 
ity. This allows us to extend the usual prepare-and-measure protocol to its entanglement-based 
formulation. We exploit a recent result in the framework of device-independent quantum key distri- 
bution to provide a simple, model-independent, security proof for the new protocol. The minimum 
efficiency required for a practical implementation of the scheme is the lowest reported to date. 
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I. INTRODUCTION 

On 1992 Charles Bennett introduced his famous 
minimal-state protocol for Quantum Key Distribution 
(QKD), named after him "B92" [T|. It makes use of two 
nonorthogonal quantum states to convey one bit of in- 
formation from a transmitting user (Alice) to a receiving 
user (Bob). 

The single-photon B92 protocol was proven uncondi- 
tional secure in [2 E]. Its main problem is the unam- 
biguous state discrimination (USD) [4] attack, initially 
discussed in [T] and later on analyzed in [3], which dra- 
matically reduces its tolerance to the losses of the com- 
munication channel and, by consequence, its applicability 
to a practical scenario. In this respect, a novel version of 
the single-photon B92 protocol, robust against the USD 
attack, has been recently introduced in [5]. It exploits 
two additional states in Alice's preparation, called "un- 
informative states" , to let the users detect a USD attack. 
For this reason it was called "us-B92" [5]. 

At variance with the more popular BB84 protocol [6], 
the B92 does not allow for an entanglement-based real- 
ization and can only be implemented in a prepare-and- 
measure (PM) configuration. This means that in order 
to guarantee its unconditional security it is necessary to 
enclose the source of photons in Alice's territory, well 
shielded against a malicious presence (Eve) eavesdrop- 
ping on the quantum channel. So, for instance, it is not 
possible to place the light source in the middle of Alice 
and Bob in order to increase the maximum working dis- 
tance [3 H] of a B92-based QKD session. The us-B92 
protocol follows the same fate as the B92, and is only PM 
as well. However we realized that it admits a straight- 
forward extension to a description and implementation 
which are based on the entanglement, called "ent-B92" 
henceforth. 

Several security proofs of B92 rely on entanglement 
distillation. However the entanglement is used only as a 
mathematical tool to demonstrate security, but the phys- 
ical realization was always based on PM scheme. Here we 
propose to use the entanglement as the physical resource 



to realize the cryptographic protocol. In this case it is 
possible to implement the protocol with the entanglement 
source placed in an untrusted location, between Alice and 
Bob. The security proofs of the standard B92 [21 [5] and 
of the us-B92 [5] are valid only assuming that the entan- 
gled source is shielded in Alice side. In our protocol even 
if the entanglement source is under Eve's control, we will 
demonstrate that it is possible to prove its security by 
connecting it with a particular form of Bell inequality [5] , 
put forward for the first time by Clauser and Home in 
1974 [TU] and later on adapted to non-maximally entan- 
gled states by Eberhard [11]. This connection, besides 
giving a new physical insight into a long-standing proto- 
col like the B92, allows us to provide a simple security 
proof for the new protocol, which exploits a recent work 
by Masanes et al. [L2] in the frame of device-independent 
(DI) QKD. 

Hence, the ent-B92 is proven u e regardless of the 
particular implementation of the protocol. The secu- 
rity proof employed is totally different from the stan- 
dard one [2j |3], which is based on the approach de- 
scribed in [T31 [H]. Notwithstanding, the obtained se- 
curity threshold is remarkably close to the one given in 
the literature, thus confirming the B92 state of the art. 
In addition to this, we managed to exploit the novel pro- 
tocol and its security proof to decrease considerably the 
minimum detection efficiency for a possible realization of 
a DI-QKD, from 92.4% reported in [H] to 75% of our 
approach. 



II. ENT-B92 PROTOCOL 

Here we introduce the entanglement-based ent-B92 
protocol that can be reduced to the B92 pQ or us-B92 [5 
protocols. Let's suppose that Alice and Bob share the 
following non-maximally entangled state: 

\*)ab =(\0*)a\<Po)b + %)a\vi)b)/^ (1) 

=P\0xU\0 x ) B +a\l x )A\lz)B, 
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where 

|^)=/3|0*} + (-l) J a|U, (2) 

{|0,>,|1*)} ({|Ox>,|lx)}) are the eigenstates of the Z (X) 
basis with \j x ) = [|0 Z ) + (-l)i|l,)]/v^, /3 = cos f , a = 
sin | and 9 £ (0, 7r/2). The state \<&)ab has been used 
in [TB] and [IT] to propose novel tests of local realism 
and is routinely implemented in laboratory [T7H20] . 

If Alice measures along the Z basis, she will project 
Bob's state in either |(/?o) or |<y9i), with equal probabilities. 
This was at the basis of the B92 unconditional security 
proof given in Ref. 2J. However, it was accompanied by 
the further assumption that the source of the entangled 
photons must be placed in Alice's secure location, hence 
unreachable to Eve. This assumption is very reasonable if 
one is interested to use a prepare-and-measure (PM) pro- 
tocol. When the actual protocol is entanglement-based, 
such an assumption should be avoided. Here we show 
that the protocol is still secure even when the light source 
is placed midway between the users. This ent-B92 scheme 
can be seen as the entanglement version of the PM B92 
scheme [1] in which Alice prepares and sends to Bob with 
equal probability the states |<po) or \tp\). The bit encoded 
by Alice is j = or j = 1 depending on the \(fj) state 
received by Bob. The density matrix pb held by Bob (or 
prepared by Alice in the PM scheme) can be written as: 

PB = ^^^ =^10,)^lW|U(l,i. (3) 

To decode the information, Bob measures the incoming 
states in the basis = {\(fik), l^fc}}) k — {0,1} where 
\<p k ) = a\0 x ) — (— l) k /3\l x ). Upon obtaining the state 
Bob decodes Alice's bit as j = k © 1 (the symbol 
"©" means "addition modulo 2") and labels the result 
as conclusive; on the contrary, upon obtaining the state 
\<Pk), Bob is not able to decode Alice's bit deterministi- 
cally, and simply labels the result as inconclusive. 

The same entangled state can be also used to perform 
the so called us-B92 j5], where, with probability 1—p, ev- 
erything goes as in the standard B92; on the other hand, 
with probability p -C 1, Alice prepares two additional, 
uninformative, states, which are chosen as follows: 

|u«i) = \0 X ) ; \us 2 ) = |Q. (4) 

In particular, the states 10^) and are prepared with 
probabilities px f3 2 and pxa 2 respectively. This is neces- 
sary to assure that Eve cannot discriminate between the 
density matrix pertaining to the signal states or to the 
uninformative states Eq. ([3| . If Alice measures along the 
X basis the entangled state ([I]), she will project Bob's 
state in either |0 X ), with probability /3 2 , or |l x ), with 
probability a 2 , thus preparing the uninformative states 
of the us-B92 protocol, Eq. Q, with the correct prob- 
abilities. So, the cnt-B92 reduces to the us-B92 if one 
considers that the results from Alice's Z basis measure- 
ments are used as bits of the final secret key, while those 



from the X basis measurements are used to perform a 
test against the USD attack, as in the us-B92. Bob's 
measurement remains the same as in the standard B92. 
However, the presence of the uninformative states allow 
the users to detect a possible USD attack [5] . 

To prove the security of the ent-B92 we follow the ap- 
proach of device independent (DI) security proof [T^] , by 
establishing a connection between the ent-B92 protocol 
and a particular Bell inequality. 

Let us write the following Bell inequality, which was 
first introduced by Clauser and Home [TO] ( "CH inequal- 
ity" for short): 

Sch = P(a u h) + P(a , h) + P(oi,6o) 

-P(ao,6o)--P(ai)-P(6i)<0. ! '" 

Here P(ai,bj) is the joint probability that Alice detects 
the state |oi) and Bob detects the state \bi), while P(ai) 
and P(bi) are the probabilities that Alice and Bob re- 
spectively measure |oi) and \bi), regardless of what is 
measured by the other user. This takes into account also 
those instances in which one of the users receives a vac- 
uum count. For instance, the term P(a±) includes the 
probability P(a 1 ,6 1) ) that Alice measures the state \ax) 
and Bob measures a vacuum. If both Alice and Bob de- 
tect a vacuum count, the event doesn't contribute to the 
CH inequality. Local realism is verified until the above 
inequality is true. On the contrary, quantum mechanics 
is expected to violate such an inequality in some range 
of values. 

The goal is usually to maximize the CH violation, but, 
in this paper, our first aim is to connect the violation 
of a Bell inequality to the ent-B92 protocol. It is then 
natural to choose the states |oj) and \bj) among the ent- 
B92 states. We select for Alice the following states: 

|ao) = |0,), |oi) = |l s ), (6) 

while we choose for Bob: 

\b ) = \Tp ), |6 1 ) = l^i)- (7) 

Using these states we are able to calculate the different 
probabilities appearing in Eq. ^ and see for which spe- 
cific values of 9 the CH inequality is violated. After some 
algebra, the value of Sch as a function of 9 is found to 
be: 

S CH (0) = ^cos0(l-cos0). (8) 

This quantity is plotted in Fig. [T] with a solid line. It is 
positive for all values of 9 in the open interval (0,7r/2), 
i.e. it violates the Bell inequality for the same interval 
of 9 in which the ent-B92 protocol is defined. Only the 
extremal points 9 = and 9 = ir/2 are excluded. The 
maximum violation occurs at 9 ma x = 7r/3, corresponding 
to Sch — 1/8. We also plot the maximum violation 
Scif W ma, t can be obtained with generic measurements 
on \<f>) AB |3J. 
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FIG. 1. Plot of Sch (solid line) as function of 9. We also 
plot with dashed line the maximum violation achievable with 
the non-maximally entangled state (JTJ, namely S c l ^f(6) = 
| (\/ sin 2 6 + 1 — 1). The maximum violation can be obtained 
if Alice measure along the states (J©J) , and Bob along the new 
states \b' ) = \Wo)> l^'i) = Wi)i where \^p' ) and |<^} axe chosen 
like in Eq. S but with an angle 0' satisfying tan 0' = sin 9. 



We notice that the choice \a\) = |l x ), which is not 
present in the traditional B92 protocol and is present in 
the us-B92 protocol only for detecting the USD attack, 
here derives directly from the Bell inequality. In fact, 
after choosing |ao), |6o) and as in the B92 protocol, 
^ and Q, the choice of \ai) = \l x ) is the one which 
maximizes the violation of the CH inequality. 



III. SECURITY PROOF OF THE ent-B92 

In this section we exploit a recent work by 
Masanes et al. [T2] to demonstrate the unconditional se- 
curity of the newly introduced ent-B92 protocol. Since 
the security proof is based on the measured correlations, 
the security is assured even if the entanglement source is 
under the Eve's control. Moreover, since in Ref. [12] a 
bound for the min entropy is found, the security obtained 
for the ent-B92 protocol is composable [40l |42] . 

In [12] it is explicitly given the final secure gain [22] 
R of a QKD protocol which uses a Bell inequality in the 
form of a CHSH inequality |23] to guarantee the overall 
security of the transmission. The length r = n conc x R of 
the secret key obtained by processing the raw key with 
an error-correcting protocol and a two-universal random 
function is, up to terms of order y/n conc , lower bounded 
by H min (A\E) - N pub , where H min (A\E) is the min- 
entropy of Alice's outcomes conditioned on Eves infor- 
mation on the joined Alice-Eve state, and N pu b is the 
number of bits published by Alice in the error-correcting 
phase. The length of the public message necessary for 
correcting Bobs errors is N pu i, = n conc x H(a\b), up to 
terms of order yJn conc . From the violation of the CHSH 
inequality, Masanes et al. in |12j showed that the min 
entropy is bounded and obtained the following bound on 
the secure gain: 

R>- log 2 [\ + y*-%fA H(a\b) (9) 



where 

Schsh = (A\Bi) + (AqBx) + (A X B ) - (A B ). (10) 

The correlation term are (AiBj) = P(ai, bj) + P(a,i,bj) — 
P(a~i , bj ) — P(ai , bj ) and {bj ) is the state orthogonal to 
\ a i) (|frj))- The term containing the quantity Schsh is 
the one corresponding to the phase- error rate of the pro- 
tocol |14) . It takes into account how much privacy ampli- 
fication [21] should be performed by the users to remove 
any residual information from Eve's hands. The term 
H(a\b) is related to the error correction procedure |25) . 
amounting to /i(Q), with h the binary entropy |26j and 
Q the QBER (quantum bit error rate) measured on the 
quantum channel. 

The bit error rate for the ent-B92 is a measurable quan- 
tity of the protocol and doesn't represent any problem. 
It come out from the number of errors n err , found by the 
users during the error correction procedure, divided by 
the number of conclusive events, n con . The phase error 
rate is given by a lower bound on Eve's information as a 
function of the CHSH value. This is the main result of 
Ref. [12] that we want to apply here. However, the re- 
sults of [12] apply to the CHSH inequality and we have to 
relate it to the CH. By using P(ai, bj) + P{ai, bj) — P(bj) 
and P(ai,bj) + P(ai,bj) = P(ai) it is possible to show 
that the generic correlation term (AiBj) of Schsh can 
be written as 4P(a i7 bj) - 2P(a,) - 2P(b :j ) + 1. Note 
that this relation holds even if the vacuum counts are 
taken into account. In fact, in this case it suffices to 
modify the correlation terms in order to consider the 
losses. We use the rule of considering the vacuum counts 
as a detection on the orthogonal states \ai) and \bj) 
(when the observable Ai and Bj are measured respec- 
tively). In this way the correlation term can be written 
as (AiBj) =P(a i ,b j ) + [P{a i ,b j ) + P(a v ,bj) + P{a i ,b v ) + 
P(a v ,b v )} - [P{a t , bj) + P(a v ,bj)} - [P{a u bj)+P{a t , &„)]. 
Since P(a^) = P(ai,bi) +P(ai, bi) + P(aj, b v ) even in this 
case we obtain (AiBj) = 4P(ai, bj)- 2P(a-) - 2P(bj) + 1. 

Starting from this relation it is straightforward to show 
that the two inequalities are related by Schsh = ^Sch + 
2 and the secure gain becomes 

R = l- log 2 ( 1 + ^/l-AScH-iScH 2 ) - M — )■ 

\ / Hcon 

(ii) 

We can notice that there is a one-to-one correspondence 
between nonlocality and security: in fact, the above se- 
cure gain is always negative when Sen < 0, i.e., when 
the CH inequality is no more violated, and is positive 
when Sch > 0, if n err = 0. In analogy with the stan- 
dard approach, in order to obtain the secure rate of the 
ent-B92 protocol, we have to multiply the obtained gain 
by the number of conclusive events collected by Alice and 
Bob: 

r en t~B92 = n con x R. (12) 

Let us remark that this last step just concerns the effi- 
ciency of the protocol, not its security, which only de- 
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pends on the gain R and on the estimation of the CHSH 
value from the measured CH inequality. 



A. Resistance to losses 

Resistance to losses - The DI security proof adopted 
for the ent-B92 offers the immense advantage of mak- 
ing the protocol independent of the practical details of 
the implementation: Alice and Bob could even purchase 
their devices directly from Eve, because the violation of a 
Bell inequality would certify the secrecy of the transmis- 
sion in any case. On the other side, this certification is 
based on a Bell test, which is hardly feasible with current 
technology (see however the proposals in [2"71 |2"B] and the 
high-efficiency detectors reported in [29, 30]). The most 
difficult step is to close the detection loophole, which re- 
quires a very low global loss rate, from the light source 
to the detectors. The maximum tolerable loss rate or, 
equivalently, the minimum global efficiency r\ g required 
to close the detection loophole, is a figure of merit of a 
given protocol: the lower rj g , the more feasible the pro- 
tocol. It is known that to close the detection loophole 
rj g cannot be lower than 2/3 (67%), a result for the first 
time found by Eberhard by an inequality very sim- 
ilar to our Eq. ([5]). Here we want to quantify r\ g for the 
ent-B92, so to study its resistance against the losses of 
the communication when the channel noise is zero. Using 
the ent-B92 states given in Eqs. it is not difficult 

to see that the resulting CH inequality can be written in 
terms of 9, ija (Alice total efficiency) and t]b (Bob total 
efficiency) as: 



S'ch(0) = VA 



T]b sin 



T] A sm 



(13) 



Note that if t)a = t\b = 1 this quantity coincides 
with that of Eq. Q. It is interesting to detail a few 
particular cases related to this result: (I) if t]a = 1, 
then S CH = 7/s(sin 2 #)/2 — sin (0/2) and local realism 
can be violated for tjb > 1/2; (II) if r/s = 1, then 
S CH — (tja — 1/2) sin 2 9 — rjA sin (9/2), and local realism 
can be violated for r] A > 2/3; (III) if 77^ = i]B = V, then 
S'ch = iv ~ V^) ?7sin 2 9 — 77 sin 2 (0/2), and local realism 
can be violated for 77 > 3/4. 

The above case (III) corresponds to a symmetric con- 
figuration, i.e. when Alice and Bob efficiencies are equal. 
In this case r\ g — 3/4, which is higher than the expected 
value 2/3, corresponding to Eberhard's result [TT]. This 
is due to the fact that the ent-B92 states are fixed and 
cannot be further optimized. However, even though not 
optimal, this result is quite interesting. In fact, due to 
the one-to-one correspondence between secure gain and 
nonlocality, we can conclude that the ent-B92 provides 
a positive, model-independent, secure gain if the users' 
efficiencies are higher than 75%. This value can be com- 
pared, e.g., with that of Ref. |15j . where the minimum 
efficiency required is 92.4%. 



We can further improve on our result by exploiting 
the above case (I), which refers to a non-symmetric con- 
figuration (see also [21 [32]), an d introducing an addi- 
tional assumption. In concrete, we place the source of 
the entangled state, Eq. ([!]), in Alice's territory, shielded 
against Eve 's intrusion. This is a standard assumption in 
QKD, which holds for all PM protocols. So we are going 
back to a PM configuration and consider the PM version 
of the device-independent ent-B92 just introduced. This 
new situation does not cover anymore the possibility that 
Alice's setup is provided by Eve, but still covers the pos- 
sible, involuntary, calibration errors in Alice's devices; 
moreover it covers, of course, the possibility that Bob's 
setup is provided directly by Eve. This can be also under- 
stood by considering that Alice devices are trusted, even 
though this alternative view is slightly stronger than our 
assumption, since we let a certain degree of untrustiness 
in Alice devices, represented by the calibration errors. 

Since Eve cannot modify the result of a Bell test by 
acting on Alice's setup, we can safely assume that Alice 
efficiency is 100%, thus falling into the above case (I), 
which entails that Bob's efficiency can be as low as 50% in 
order to provide a positive secure gain independent of the 
implementation details. This result coincides with what 
obtained in [35] by a different approach and resembles 
an entanglement-steering scenario [34] . where detectors 
are asymmetrically treated by the users in the search of 
an EPR-stecring inequality violation [35 . 



B. Resistance to noise 

In order to perform a fair comparison with the stan- 
dard PM protocols, we place the entangled light source 
very close to Alice station. Then we consider a depolariz- 
ing channel acting on the state going from Alice to Bob, 
as follows: 

P 

p -t p = (1 - p)p + -^{o-xpo-x + VyPVy + <y z pa z ), (14) 

with (Ti the usual Pauli matrices. It is straightforward 
to show that the quantity Sch is modified by the de- 
polarizing channel as follows: S' CH — 1 — ^-Sch — 
where Sch is given by Eq. . By substituting S' CH 
in Eq. ( 12 1 we obtain the secure rate of the ent-B92 as 
a function of the depolarizing parameter p. The result, 



normalized by the total number of events detected by the 
users, is plotted in Fig. [2} In the same figure we also plot 
the secure normalized rate R pertaining to the PM B92 
protocols, i.e. the standard B92 and the us-B92. In fact, 
they both share the same resistance against a depolariz- 
ing channel [36] . The ent-B92 rate remains positive up to 
Pmax B92 — 0.03 36, which is about the same value known 
in the literature for PM-B92 (p™~ B92 = 0.034 0). In 
obtaining these results, the optimal angle 9 for the ent- 
B92 is nearly constant regardless of the value of p; it 
is 61.56° for p = 0.01, 62.65° for p = 0.02, 63.57° for 
p = 0.03. These values of the optimal 9 are quite close 
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Bob, which is no more given by Eq. ([I]) but becomes: 



IXi)fc(Xi|- Since the state p' 
is separable it cannot violate any Bell inequality, included 
the CH inequality, Eq. thus letting the users detect 
the attack. It is worth noticing that this simple argument 
applies to any generic intercept-and-resend attack. 




FIG. 2. Secure normalized rate pertaining to the DI 
entanglement-based ent-B92 (solid line) and to PM B92 and 
us-B92 (dashed line) as function of the depolarizing rate p 
(see text). The maximum depolarizing rate tolerated by the 
ent-B92 is fCi~ S92 ~ 0.0336, nearly the same as PM-B92, 

PM- «»' ■ ™ 

Vmax 



n PM—B92 = q 034 [J] 



to those corresponding to the optimal 9 for the us-B92 
(about 55°) [5] and for the asymmetric feedback (about 
60°) [37]. It can be noted that none of the secure rates 
reported in Fig. [2] starts from the value 1. This is due 
to the presence of inconclusive counts in all the B92-like 
protocols. Other DI protocols provide a better efficiency 
and a higher resistance to noise P21 [38] . 

It is interesting to observe that if the users perform 
generalized measurements thus obtaining an estimate for 
the quantity Sq^ x , this does not improve the final se- 
cure rate of the ent-B92. The problem is that in order 
to estimate S™ff the user Bob has to measure along an 
angle 9' which is different from the angle 9 characteriz- 
ing the initial entangled state, Eq. ([I]). This increases the 
error correction term h(^ !rjL ) in Eq. ( |12| , thus reducing 
the overall rate. In fact we have verified that the maxi- 
mum tolerated noise in this case amounts to p ~ 0.0234, 
obtained with an angle 9 ~ 75°. 



C. Resistance to USD attack 

The security proof of the ent-B92 is DI and covers 
all possible attacks performed by Eve, included the USD 
attack, which typically represents the most dangerous 
menace against B92-like protocols. In the simplest USD 
attack [T] Eve performs the same measurement as Bob. 
When she measures |</? ) or \tp x ) she sends or re- 
spectively. When she measures \<po) or she doesn't 
send anything to Bob, making him detect a loss. She 
thus performs the following POVM: ni = ||^ )(^oIj 

n 2 = WVxWxl n 3 = l^oX^ol, n 4 = ||^)<^|. De- 

pending on the measured n^, she sends to Bob the corre- 
sponding following states |xi) = |<Pi), |xa) = l^o), IX3) = 
|X4) = \vac), where \vac) is the vacuum state. If such 
an attack is brought against the quantum communica- 
tion, it alters the quantum state shared by Alice and 



IV. CONCLUSION 

In the present paper we have connected the long- 
standing B92 protocol to a particular form of Bell in- 
equality This allowed us to provide a simple security 
proof for a new entanglement-based B92-like protocol 
which is independent of how the QKD apparatus is mod- 
eled. In the proposed protocol, called "ent-B92", the 
same quantum states can be used either to distill the 
final key or to test the violation of a Bell inequality. To- 
gether with the fact that only two measurement bases are 
required in Alice and Bob sites, this represents a prac- 
tical advantage respect to other device-independent pro- 
tocols, which have to switch between different measure- 
ment bases in order to distill secret bits or to perform 
a Bell test [T51 131] ■ The gain and tolerance to noise of 
the ent-B92 are lower than in other device-independent 
protocols [HI [38], but both the fi gures can be improved 
by extending to the new protocol the same techniques 
available for the prepare-and- measure B92 [5], Further- 
more the minimum required efficiency to run the ent-B92 
is 75% if the users' efficiencies are assumed to be equal, 
and 50% if the source of entangled states is enclosed in 
Alice's territory. For other protocols [TS] a value of at 
least 92.4% was necessary. 

The ent-B92 protocol turns out to be a particular 
case of an entanglement-distribution problem. It orig- 
inates from a non-maximally entangled state which is 
distributed to two distant users. As a matter of fact, this 
kind of entanglement gives rise to a local non-symmetric 
density matrix which can be exploited by the users to 
efficiently stabilize the transmission channel without any 
external communication [37]. This could represent an 
important resource when entanglement has to be dis- 
tributed from a satellite or on very long distances. 

A test confirming the feasibility of the ent-B92 proto- 
col can be experimentally performed with current tech- 
nology. The non-maximally entangled state of Eq. ([I]) 
can be produced in laboratory [TTH2T)] and a proof of 
principle experiment is on the way. 
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